[JEP-200] - Status update, retrospective, and changes in maintenance on May 01

[Oleg Nenashev]

Hi all,

I would like to provide a status update regarding JEP-200 stories. It has been more than 3 months since the original release in Jenkins 2.102 and one month since the release in LTS (announcement). Although we still receive some new JEP-200 issues, the community ratings of releases are pretty good. We would like to thank everybody who helped to get the the plugins fixed and released!

As you probably know, the proactive maintenance period ends on May 01 according to the post-release maintenance plan. I would like to briefly summarize the current status:

• Adoption: >23% of Jenkins installations (April 01 stats)
• Since January 13 we got 119 JEP-200 issues in Jenkins JIRA, there are also some in GitHub
• 82 plugins were affected by JEP-200 (hosted in Jenkins Update Centers)
• 66 plugins got fixes, 16 plugins still need fixes (5 pending fixes)
• The most of unfixed plugins are niche ones with less than 100 installations
  
• Notable plugins: Google OAut, Kubernetes, Gitlab Merge Request Builder, AWS Device Farm
  
• We have also applied several core patches, including whitelist updates and diagnosability improvements
• We hope to get 2 whitelist patches backported to 2.107.3 (JENKINS-50616, JENKINS-50939)
  
• There is a major improvement in Remoting Exception serialization, which should be available in the next LTS baseline (part of JENKINS-50237)
  

What is going to happen after May 01?

• JEP-200 maintainers will deliver the rest of pending fixes
• JEP-200 maintainers will stop proactively monitoring all tickets in Jenkins JIRA and GitHub issues/PRs to discover regressions caused by the change
  
• Core/Plugin maintainers will be expected to triage newly reported defects to their components
• JEP-200 maintainers will be available to do some consulting in mailing lists and reviews in GitHub on-demand
  

We have also started a retrospective Google doc. This is the first Jenkins security hardening change with such level of regressions by design, and we would appreciate your feedback in order to make future changes smoother. We will also conduct a JEP-200 status update session tomorrow at the governance meeting. Please feel free to join if you want to discuss JEP-200. Any feedback will be appreciated.

Thanks for your time,
Oleg Nenashev

[Oleg Nenashev]

There was no votes against the change in this thread or at the governance meeting, so I am going forward with the change: https://github.com/jenkins-infra/jenkins.io/pull/1520

Status update:

• Since the announcement on April 24 there were 10 new JEP-200 issues created, mostly discovered by me during code inspections for PrintStream usages. These issues appear only in some edge cases.
• There were also more serious defects in Whitesource (JENKINS-51025) and in Git Changelog (JENKINS-50990) plugins. Both regressions are fixed and released by now
  
• Both proposed core backports have been integrated into 2.107.3-rc. They will be also available in the 2.119 weekly once it is released

Best regards,
Oleg